Feature: Driver-level fallback chain for MCP drivers when policy denies

**Label:** enhancement

### Problem
MCP driver cards (`drivers/mcp/*.yaml`) evaluate an access-policy per call. Two pain points in multi-agent deployments:

1. When a card has no `policy` section, the effective default is `deny`, so **every** tool call silently fails with `driver_policy_denied`. In our fleet, 6 of 8 agents lost Tavily MCP with no obvious signal, and the built-in `web_search` (HTTP path, bypasses driver cards) kept working — which made the failure very hard to diagnose.
2. There is no fallback: when a driver call is denied or the remote MCP errors, the agent has no configured alternate (e.g. `tavily_search` → `anysearch` → built-in `web_search`).

### Proposed
- `fallback: [driver_name | builtin_tool]` list in the driver YAML; attempted in order on policy-deny or transport error.
- Console: show a per-driver "policy status" badge (allow/ask/deny + last denied call) in the Drivers panel.
- Clearer error message pointing to the exact YAML file and missing `policy:` key when deny comes from absent policy.

### Environment
QwenPaw 2.2.0, Docker, multi-agent workspace (9 agents), NFS-backed working dir.